Technology Risk & Control Consultant

Role Overview

Join a role that’s centralto our Technology security and resilience architecture, offering a uniqueopportunity to shape our organisation's tech risk and digital operationsresilience strategy and operations.

As a Tech Risk & ControlConsultant at LinkPay, you will play apivotal role in shaping and implementing the organization’s Technology Risk andDigital Operations Resilience strategy and operations.

Leveraging your advancedknowledge and expertise in technology-risk and digital-operations resiliencedisciplines, you will identify, design, oversee, and mitigate compliance andoperational risks in line with the organization's standards. You willcollaborate with various stakeholders, including Compliance, Legal, Risk, Product,Engineering, and Outside Counsel, to develop and maintain a comprehensive viewof the Technology Risk and Digital Operations Resilience posture and its impacton the business. Your ability to make calculated decisions, manage teams, anddrive strategic projects will be crucial in ensuring the organization'sadherence to regulatory obligations and industry best practices within MAS TRMand EU DORA domains. Your work will contribute to the long-term success andresilience of the organization in an ever-evolving Technology and Digital OperationsResilience landscape.

Key Responsibilities

1.Regulatory Compliance & Gap Assessment

•   Independently lead and implementdigital operations resilience and technology risk management strategies,policies, and processes to identify, assess, mitigate risks, and drivestrategic projects and initiatives to enhance the organization's technologyrisk management and digital operations resilience capabilities, in line withMAS TRM, EU DORA, industry best practices and the organization's standards andregulatory requirements.

•      Conduct periodic gap assessmentsmapping current technology, cybersecurity, and third-party risk controlsagainst MAS TRM and DORA's five pillars (ICT risk management, incidentreporting, digital operational resilience testing, third-party risk management,information sharing) domains.

•      Track regulatory developments,technical standards updates, and supervisory expectations issued by the ESAs(EBA, ESMA, EIOPA), MAS TRM & Outsourcing domains, and translate these intointernal policy and control updates.

2.Policy, Framework & Documentation

•      Draft, review, and maintain ICTrisk management frameworks, technology risk policies, business continuity anddisaster recovery (BCP/DR) documentation, and third-party/outsourcing riskpolicies aligned to MAS TRM, DORA and industry best practices.

•      Develop and maintain the ICTRegister of Information (RoI) required under MAS TRM and DORA, and equivalentthird-party/vendor risk registers, in line with industry best practices andoutsourcing guidelines.

•      Prepare quarterly board andmonthly management-level reporting MIs, risk registers, and compliancedashboards summarising technology risk posture, control effectiveness, andregulatory readiness.

3.Third-Party & ICT Risk Management

•      Own the third-party/ICT serviceprovider risk management lifecycle: due diligence, contractual clause review(including DORA-mandated contractual provisions), ongoing monitoring,concentration risk assessment, and exit strategy planning.

•      Assess and classifycritical/important ICT third-party providers in line with MAS TRM and DORAoutsourcing/criticality criteria.

•      Coordinate with procurement,legal, and vendor management teams to ensure new and existing technologycontracts meet regulatory requirements.

4.Incident Management, Testing & Resilience

•      Support the design andmaintenance of ICT-related incident classification, escalation, and regulatoryreporting processes consistent with MAS TRM, Outsourcing and DORA incidentreporting timelines and notification requirements.

•      Coordinate digital operationalresilience testing, including vulnerability assessments, scenario-basedtesting, and (where applicable) threat-led penetration testing (TLPT), workingwith Information Security and external testing providers.

•      Support tabletop exercises,BCP/DR testing, and crisis simulation exercises to validate organisationalresilience against ICT disruption.

5.Governance, Training & Stakeholder Engagement

•      Act as co-liaison withregulators, auditors, and examiners on technology risk and digital operationalresilience matters, including preparation of regulatory submissions andresponses to inspection findings.

•      Design and deliver training andawareness programmes on MAS TRM, Outsourcing and DORA obligations fortechnology, risk, compliance, and business stakeholders.

•      Support committee reporting(Risk & Compliance Committee, ICT Risk Committee) with clear,decision-ready materials on technology risk exposure and remediation status.

•      Partner with Technology, Complianceand Legal teams to embed regulatory requirements into day-to-day operationalpractice.

Key Qualifications & Experience

Education

•      Bachelor's degree in InformationTechnology, Computer Science, Risk Management, Law, Finance, or a relateddiscipline.

Experience

•      Minimum 5-8 years of experience orequivalent expertise in technology risk management, digital operationsresilience, information security, or a related field, with a focus on managingrisk identification, assessment, and mitigation within financial services, crypto-assets,or payments industry.

•      Demonstrated hands-on experiencedesigning and implementing MAS TRM and DORA compliance programmes, includingICT risk frameworks, third-party risk management, and incident reportingobligations.

Knowledge& Technical Skills

•      Strong working knowledge of ICTrisk management frameworks (e.g., NIST CSF, ISO/IEC 27001, COBIT) and how thesemap to MAS TRM and DORA control expectations.

•      Familiarity with related EUregulatory frameworks (PSD2/PSD3, MiCA, GDPR) and Singapore (MAS TRM &Outsourcing Notices & Guidelines) to the extent they intersect withtechnology and operational risk.

•      Understanding of ICTthird-party/outsourcing risk management, cloud risk considerations, and vendorconcentration risk assessment methodologies.

Certifications

•      CISA, CRISC, CISM, CISSP, orequivalent technology risk/audit certification.